Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting

Recorded Future attributes a multi-phase espionage campaign to GRU-linked APT28 (BlueDelta) that used HeadLace malware and credential-harvesting pages across Europe—especially targeting Ukrainian defence entities, rail infrastructure, and related organizations—delivered via spear-phishing and a multi-stage redirection infrastructure (GitHub, InfinityFree, webhook.site, mocky.io) with geofencing and exfiltration via compromised Ubiquiti routers; related Turla activity is also noted.